{
  "id": 7758647,
  "title": "Who does open source actually depend on? I scanned the 433 most-starred JS repos",
  "url": "https://urgent.news/2026/09/16/who-does-open-source-actually-depend-on-i-scanned-the-433-most",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-16T09:53:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ahmed_benhamadi_318b848a1/who-does-open-source-actually-depend-on-i-scanned-the-433-most-starred-js-repos-2m80"
  },
  "original_language": "en",
  "account": "The scan analyzed the 433 most-starred JavaScript and TypeScript repositories on GitHub, examining their lockfiles to determine which individuals hold the publishing rights for the packages used within each project. The findings revealed that a median project installs 945 packages, with many of these packages being published by a single person. Microsoft developer sindresorhus was found to be responsible for publishing alone 513 of the packages scanned, impacting 99% of the repositories. Other prominent publishers included isaacs (98% coverage), juliangruber (95%), ljharb (94%), and kevva (93%). Together, these top five publishers touched every single repository in the set. The scan also revealed that 98% of the projects contained at least one dead dependency, meaning packages that are either deprecated or archived. Only 24% of the packages carried a funding link, highlighting a lack of financial support for maintaining these packages. The top publishers have GitHub Sponsors pages, indicating some level of financial support, but this may not be the case for the owners of the dead dependencies. The tool can be used to identify which account holds the publishing rights for a project's packages, helping to identify potential risks and dependencies. The dataset includes a list of dead packages and their maintained replacements, which can be used to improve the maintainability of projects.",
  "summary": "Two years ago the xz backdoor reminded everyone that \"the ecosystem\" is often one tired person. I wanted to know how true that is for an ordinary JavaScript project, so I built a small tool and pointed it at the most popular repositories on GitHub. The question A modern web project installs hundreds of packages you never chose one by one. For each of them, someone holds the right to publish the…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}